Cover Letter Detail
Show a cover letter.
GET /api/covers/808425/?format=api
{ "id": 808425, "url": "http://patchwork.ozlabs.org/api/covers/808425/?format=api", "web_url": "http://patchwork.ozlabs.org/project/netdev/cover/20170831205635.80256-1-chenbofeng.kernel@gmail.com/", "project": { "id": 7, "url": "http://patchwork.ozlabs.org/api/projects/7/?format=api", "name": "Linux network development", "link_name": "netdev", "list_id": "netdev.vger.kernel.org", "list_email": "netdev@vger.kernel.org", "web_url": null, "scm_url": null, "webscm_url": null, "list_archive_url": "", "list_archive_url_format": "", "commit_url_format": "" }, "msgid": "<20170831205635.80256-1-chenbofeng.kernel@gmail.com>", "list_archive_url": null, "date": "2017-08-31T20:56:32", "name": "[0/3] Security: add lsm hooks for checking permissions on eBPF objects", "submitter": { "id": 70894, "url": "http://patchwork.ozlabs.org/api/people/70894/?format=api", "name": "Chenbo Feng", "email": "chenbofeng.kernel@gmail.com" }, "mbox": "http://patchwork.ozlabs.org/project/netdev/cover/20170831205635.80256-1-chenbofeng.kernel@gmail.com/mbox/", "series": [ { "id": 906, "url": "http://patchwork.ozlabs.org/api/series/906/?format=api", "web_url": "http://patchwork.ozlabs.org/project/netdev/list/?series=906", "date": "2017-08-31T20:56:32", "name": "Security: add lsm hooks for checking permissions on eBPF objects", "version": 1, "mbox": "http://patchwork.ozlabs.org/series/906/mbox/" } ], "comments": "http://patchwork.ozlabs.org/api/covers/808425/comments/", "headers": { "Return-Path": "<netdev-owner@vger.kernel.org>", "X-Original-To": "patchwork-incoming@ozlabs.org", "Delivered-To": "patchwork-incoming@ozlabs.org", "Authentication-Results": [ "ozlabs.org;\n\tspf=none (mailfrom) smtp.mailfrom=vger.kernel.org\n\t(client-ip=209.132.180.67; helo=vger.kernel.org;\n\tenvelope-from=netdev-owner@vger.kernel.org;\n\treceiver=<UNKNOWN>)", "ozlabs.org; dkim=pass (2048-bit key;\n\tunprotected) header.d=gmail.com header.i=@gmail.com\n\theader.b=\"AhNgV+Yx\"; dkim-atps=neutral" ], "Received": [ "from vger.kernel.org (vger.kernel.org [209.132.180.67])\n\tby ozlabs.org (Postfix) with ESMTP id 3xjvnW3QK8z9t1t\n\tfor <patchwork-incoming@ozlabs.org>;\n\tFri, 1 Sep 2017 06:57:03 +1000 (AEST)", "(majordomo@vger.kernel.org) by vger.kernel.org via listexpand\n\tid S1751227AbdHaU5C (ORCPT <rfc822;patchwork-incoming@ozlabs.org>);\n\tThu, 31 Aug 2017 16:57:02 -0400", "from mail-pf0-f195.google.com ([209.85.192.195]:35101 \"EHLO\n\tmail-pf0-f195.google.com\" rhost-flags-OK-OK-OK-OK) by vger.kernel.org\n\twith ESMTP id S1750908AbdHaU5A (ORCPT\n\t<rfc822;netdev@vger.kernel.org>); Thu, 31 Aug 2017 16:57:00 -0400", "by mail-pf0-f195.google.com with SMTP id g13so445937pfm.2;\n\tThu, 31 Aug 2017 13:57:00 -0700 (PDT)", "from fengc.mtv.corp.google.com ([100.98.121.64])\n\tby smtp.gmail.com with ESMTPSA id\n\tg68sm710967pfj.33.2017.08.31.13.56.58\n\t(version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128);\n\tThu, 31 Aug 2017 13:56:59 -0700 (PDT)" ], "DKIM-Signature": "v=1; a=rsa-sha256; c=relaxed/relaxed;\n\td=gmail.com; s=20161025;\n\th=from:to:cc:subject:date:message-id:mime-version\n\t:content-transfer-encoding;\n\tbh=cWCmoBhp4DOJqao3nPzX3VnzjoZJZCLlbuASoe3ehiw=;\n\tb=AhNgV+YxGGzzizygBwhD83E+TO3+hbZw3+sNHipudwtM3eZhmoaVPC0N8iHPj63cgu\n\tzQocqw4x+aSmZEhn8z4bwFG/Sk6hu/dQzgfxO4TH21cyMrEsjNcpt2eBE7OEm6OPL1cO\n\tZA94IE2Jh02taCAvhnRjo7aUgdT5L/OChU/NeLDKd16nkB1242oRKx9JiWp5iNXm8QOE\n\t/n/okmT2iBG0DBMwQI1vBBkHxw99IVY4ecQnb4zHvGJfRfu8AGTYN4jxlGU/UEanfmIe\n\tBipsrVM6bj+YBAqmeYUhVXZMLTYZH1UZetLzd7J8CX47VTI+uOMLLD2df1hxO1vr1h7x\n\tmSZg==", "X-Google-DKIM-Signature": "v=1; a=rsa-sha256; c=relaxed/relaxed;\n\td=1e100.net; s=20161025;\n\th=x-gm-message-state:from:to:cc:subject:date:message-id:mime-version\n\t:content-transfer-encoding;\n\tbh=cWCmoBhp4DOJqao3nPzX3VnzjoZJZCLlbuASoe3ehiw=;\n\tb=MCyiTDO6MK9DOq8xMP4LedEtsZElHZ85dV7QHg4Y+Fla0Epjm/WWc8ukZ3fVJO/cYP\n\t9lScuuPFJv2dLQhIDsgRx6arN+uepyjPRqZdKTiimh9zPIq0XPIpf63t0QNpuyUP4KSf\n\tiBj1gLsBJhYJFFhceSo6bjgRhE4tS0z8yU7vHUMCosjIZI1oblqtxwK2Z9mb97RBPnUL\n\t7GBSZ22pcQmaJDmpHSBV0x62KWh6STMeWyJ2iVVXVUxnQnhPyFV+ZUOoCXohfYxZeMRc\n\t72FiiCsdDVhOK1f2XaQ+jYAd8X8CNrSuJapu8WaE4JBBC9TxmAQSwyiwM4DaOlE57QLS\n\tGYQQ==", "X-Gm-Message-State": "AHYfb5jXXEBGpv2dP1indmw7yIBkuzxt0pDZA2L0TtTXz7S9KQeEd3gn\n\t1cBaBjHnah/Tbfkj", "X-Google-Smtp-Source": "ADKCNb62TiOygWIh3oPCaUe2yQO0f5udpqQuOQRGlO4MVF8/RkC2aA8M1lNBq4ChPG4+27hiOMTv2A==", "X-Received": "by 10.99.122.16 with SMTP id v16mr3908455pgc.321.1504213019535; \n\tThu, 31 Aug 2017 13:56:59 -0700 (PDT)", "From": "Chenbo Feng <chenbofeng.kernel@gmail.com>", "To": "linux-security-module@vger.kernel.org", "Cc": "Jeffrey Vander Stoep <jeffv@google.com>, netdev@vger.kernel.org,\n\tSELinux <Selinux@tycho.nsa.gov>,\n\tAlexei Starovoitov <alexei.starovoitov@gmail.com>,\n\tlorenzo@google.com, Chenbo Feng <fengc@google.com>", "Subject": "[PATCH 0/3] Security: add lsm hooks for checking permissions on\n\teBPF objects", "Date": "Thu, 31 Aug 2017 13:56:32 -0700", "Message-Id": "<20170831205635.80256-1-chenbofeng.kernel@gmail.com>", "X-Mailer": "git-send-email 2.14.1.581.gf28d330327-goog", "MIME-Version": "1.0", "Content-Type": "text/plain; charset=UTF-8", "Content-Transfer-Encoding": "8bit", "Sender": "netdev-owner@vger.kernel.org", "Precedence": "bulk", "List-ID": "<netdev.vger.kernel.org>", "X-Mailing-List": "netdev@vger.kernel.org" }, "content": "From: Chenbo Feng <fengc@google.com>\n\nMuch like files and sockets, eBPF objects are accessed, controlled, and\nshared via a file descriptor (FD). Unlike files and sockets, the existing\nmechanism for eBPF object access control is very limited. Currently there\nare two options for granting accessing to eBPF operations: grant access to\nall processes, or only CAP_SYS_ADMIN processes. The CAP_SYS_ADMIN-only\nmode is not ideal because most users do not have this capability and\ngranting a user CAP_SYS_ADMIN grants too many other security-sensitive\npermissions. It also unnecessarily allows all CAP_SYS_ADMIN processes\naccess to eBPF functionality. Allowing all processes to access to eBPF\nobjects is also undesirable since it has potential to allow unprivileged\nprocesses to consume kernel memory, and opens up attack surface to the\nkernel.\n\nAdding LSM hooks maintains the status quo for systems which do not use an\nLSM, preserving compatibility with userspace, while allowing security\nmodules to choose how best to handle permissions on eBPF objects. Here is\na possible use case for the lsm hooks with selinux module:\n\nThe network-control daemon (netd) creates and loads an eBPF object for\nnetwork packet filtering and analysis. It passes the object FD to an\nunprivileged network monitor app (netmonitor), which is not allowed to\ncreate, modify or load eBPF objects, but is allowed to read the traffic\nstats from the object.\n\nSelinux could use these hooks to grant the following permissions:\nallow netd self:bpf { create modify read…};\nallow netmonitor netd:bpf read;\n\nIn this patch series, 5 security hooks is added to the eBPF syscall\nimplementations to do permissions checks. The LSM hooks introduced to eBPF\nmaps and programs can be summarized as follows:\n\n\tBpf_map_create: check for the ability of creating eBPF maps.\n Bpf_map_modify: check the ability of update and delete eBPF map\n\t\t\tentries.\n Bpf_map_read: \tcheck the ability of lookup map element as well as\n\t\t \tget map keys.\n Bpf_post_create: initialize the security struct inside struct\n\t\t\t bpf_map\n Bpf_prog_load: check the ability for loading the eBPF program.\n\nIn order to store the ownership and security information about eBPF maps,\na security field pointer is added to the struct bpf_map. And a simple\nimplementation of selinux check on these hooks is added in selinux\nsubsystem.\n\nChenbo Feng (3):\n security: bpf: Add eBPF LSM hooks to security module\n security: bpf: Add eBPF LSM hooks and security field to eBPF map\n selinux: bpf: Implement the selinux checks for eBPF object\n\n include/linux/bpf.h | 3 +++\n include/linux/lsm_hooks.h | 41 ++++++++++++++++++++++++++++\n include/linux/security.h | 36 +++++++++++++++++++++++++\n kernel/bpf/syscall.c | 28 +++++++++++++++++++\n security/security.c | 28 +++++++++++++++++++\n security/selinux/hooks.c | 54 +++++++++++++++++++++++++++++++++++++\n security/selinux/include/classmap.h | 2 ++\n security/selinux/include/objsec.h | 4 +++\n 8 files changed, 196 insertions(+)\n\n--\n2.14.1.581.gf28d330327-goog" }